ext_if="fxp0"
int_if="xl0"
wlan_if="wi0"

OutTCP="{1494, 5999, http, https, pop3, whois, domain, ssh, ftp, ftp-data, auth, ntp, nntp}"
OutUDP="{1604, ntp, domain}"

set loginterface $ext_if
set skip on lo0
set block-policy return
scrub in on $ext_if #fragment reassemble random-id reassemble tcp
scrub out on $ext_if random-id

nat on $ext_if from $wlan_if:network to any -> ($ext_if:0) static-port
nat on $ext_if from $int_if:network to any -> ($ext_if:0) static-port
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr on $ext_if proto tcp from any to ($ext_if) port 21 -> 192.168.1.50 port 21
rdr on $ext_if proto tcp from any to ($ext_if) port 20 -> 192.168.1.50 port 20

# Spamd whitelist table
table <spamd-white> persist

# Spamd and Postfix redirect on external interface. If in whitelist table go to Postfix.
# If not in whitelist table go to spamd.
rdr on $ext_if proto tcp from  <spamd-white> to ($ext_if) port smtp -> lo0 port smtp
rdr on $ext_if proto tcp from !<spamd-white> to ($ext_if) port smtp -> lo0 port spamd

# Dovecot pop3s/imap Server (internal interface) redirect for internal hosts.
rdr on $int_if proto tcp from any to $int_if port imaps -> lo0 port imaps


#-------
# Set default policy
#------
block quick inet6
antispoof quick for { lo0 $ext_if $int_if }
block log all

pass out log on $ext_if inet proto udp from any to any port $OutUDP keep state
pass out log on $ext_if inet proto tcp from any to any port $OutTCP flags S/SA modulate state
block quick proto tcp from 192.168.2.200 to any port 25
pass out log on $ext_if inet proto tcp from $ext_if to any port 25 flags S/SA modulate state
block out on $ext_if inet proto tcp from 192.168.2.200 to any port 25
pass in on $ext_if proto tcp to $ext_if port ssh flags S/SA keep state
pass in on $ext_if proto tcp to lo0 port spamd flags S/SA keep state
pass in log quick inet proto icmp from any to self icmp-type echoreq keep state

pass in log on $ext_if inet proto tcp from any to 192.168.1.50 port 20 keep state
pass in log on $ext_if inet proto tcp from any to 192.168.1.50 port 21 keep state

# Allow traffic for postfix mail server from anyone on the outside and the inside.
pass in on $ext_if inet proto tcp from any to lo0 port smtp flags S/SAFPRU synproxy state

# Allow traffic to Dovecot pop3 server from any network on the inside. Change to external if needed.
pass in on $int_if inet proto tcp from any to lo0 port imaps flags S/SAFPRU keep state

pass log on $int_if